{"data":{"package":{"purl":"pkg:npm/lodash@4.17.20","ecosystem":"npm","name":"lodash","version":"4.17.20"},"deprecated":false,"yanked":false,"notice":null,"verdict":"warn","reasons":[{"code":"vuln","verdict":"warn","id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE","fixed":["4.17.21"]},{"code":"vuln","verdict":"warn","id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-r5fr-rjxr-66jc"],"summary":"Command Injection in lodash","severity":"HIGH","fixed":["4.17.21"]},{"code":"vuln","verdict":"warn","id":"GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","severity":"MODERATE","fixed":["4.18.0"]},{"code":"vuln","verdict":"warn","id":"GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-35jh-r3h4-6jhm"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","severity":"HIGH","fixed":["4.18.0"]},{"code":"vuln","verdict":"warn","id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-f23m-r3pf-42rh"],"summary":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","severity":"MODERATE","fixed":["4.17.23"]}],"kev_catalog_version":"2026.10.16"},"meta":{"dataset":"preflight","datasets":{"osv":{"dataset":"osv","snapshot_id":"osv-2026-10-16T21:43:31.456Z","as_of":"2026-10-16T21:43:31.456Z","retrieved_at":"2026-10-16T21:43:25.384Z","age_hours":1.65,"cadence_hours":6,"stale_at":"2026-10-17T09:43:25.385Z","stale":false,"source":"https://osv.dev/","attribution":"Vulnerability data from OSV.dev and the upstream databases listed, under their licences; joined and reformatted by Stack Facts (records are modified: fields trimmed and reshaped).","licence_url":"/licences","ecosystems":{"npm":{"imported_at":"2026-10-16T21:43:25.384Z","checked_at":"2026-10-16T21:43:25.384Z","records":229650,"sha256":"c3ae2ef2bd2a80ec2b10c869c8b698c9f39dad2a4a4fdc33bf510cfb2af0ac79"}},"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source."},"kev":{"dataset":"kev","snapshot_id":"kev-20261016T204226Z-6260e5f8","as_of":"2026-10-16T20:42:26Z","retrieved_at":"2026-10-16T20:42:26.000Z","source":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","licence":"CC0-1.0","attribution":"Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.","sha256":"6260e5f8a11a89bcd2181e175cfd9987196f22d6d6a9ef05ec08774adb760c50","signature":"Pucf1Flo6XZjuIOf5FUEGBYSQH1ZB2gepIOnCXTI3NcVK9jlCgROSnlbRMKVrI5Vn5Mg4dxZwT-tuXejTFioBQ","key_id":"sf-2026-10","manifest_url":"/v1/kev/manifest","stale":false,"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source."},"eol":{"dataset":"eol","snapshot_id":"eol-20261016T194220Z-11c5b4ea","as_of":"2026-10-16T19:42:20Z","retrieved_at":"2026-10-16T19:42:20.000Z","source":"https://endoflife.date","licence":"MIT","attribution":"Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License (https://github.com/endoflife-date/endoflife.date/blob/master/LICENSE).","sha256":"11c5b4ea541bc2bc0925e3c21716c8ebe61b74a073618959f94e75f1c702a42b","signature":"hBm1wduJYJSdybG0c5a7w2eGiTOkWDwnWiAk0xO1AOo0HGp0NSDNBXCWc8v-AnGuUrwruZvx5fNMHsO5Q-owAA","key_id":"sf-2026-10","manifest_url":"/v1/eol/manifest","stale":false,"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source."},"registry":{"source":"https://registry.npmjs.org/","retrieved_at":"2026-10-16T23:22:14.777Z","attribution":"Package metadata from the npm registry (registry.npmjs.org); licence ids and names from the SPDX License List (CC BY 3.0). Reformatted by Stack Facts. Not endorsed by npm, Inc., GitHub or the Linux Foundation.","stale":false}},"stale":false,"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source.","sample":true,"next":"POST /v1/preflight returns this shape for any package version (paid, $0.008); GET /v1/try/preflight is {\"package\":\"pkg:npm/lodash@4.17.20\"} only (free)"}}